re-work original osmo-bts with support for sysmocom femtobts

This code re-works osmo-bts to add support for the upcoming sysmocom BTS.

It also tries to add some level of abstraction between the generic
part of a BTS (A-bis, RSL, OML, data structures, paging scheduling,
BCCH/AGCH scheduling, etc.) and the actual hardware-specific bits.

The hardware-specific bits are currently only implemented for the sysmocom
femtobts, but should be (re-)added for osmocom-bb, as well as a virtual
BTS for simulation purpose later.

The sysmocom bts specific parts require hardware-specific header files
which are (at least currently) not publicly distributed.

14 files changed, 2342 insertions, 0 deletions

diff --git a/src/osmo-bts-sysmo/Makefile.am b/src/osmo-bts-sysmo/Makefile.am
new file mode 100644
index 00000000..6b00b9e3
--- /dev/null
+++ b/src/osmo-bts-sysmo/Makefile.am
@@ -0,0 +1,16 @@
+INCLUDES = $(all_includes) -I$(top_srcdir)/include
+AM_CFLAGS = -Wall $(LIBOSMOCORE_CFLAGS) $(LIBOSMOGSM_CFLAGS) $(LIBOSMOVTY_CFLAGS)
+LDADD = $(LIBOSMOCORE_LIBS) $(LIBOSMOGSM_LIBS) $(LIBOSMOVTY_LIBS)
+
+bin_PROGRAMS = sysmobts sysmobts-remote l1fwd-proxy
+
+COMMON_SOURCES = main.c femtobts.c l1_if.c oml.c bts_model.c
+
+sysmobts_SOURCES = $(COMMON_SOURCES) l1_transp_hw.c
+sysmobts_LDADD = $(top_builddir)/src/common/libbts.a $(LDADD)
+
+sysmobts_remote_SOURCES = $(COMMON_SOURCES) l1_transp_fwd.c
+sysmobts_remote_LDADD = $(top_builddir)/src/common/libbts.a $(LDADD)
+
+l1fwd_proxy_SOURCES = l1_fwd_main.c l1_transp_hw.c
+l1fwd_proxy_LDADD = $(top_builddir)/src/common/libbts.a $(LDADD)
diff --git a/src/osmo-bts-sysmo/bts_model.c b/src/osmo-bts-sysmo/bts_model.c
new file mode 100644
index 00000000..71d8803c
--- /dev/null
+++ b/src/osmo-bts-sysmo/bts_model.c
@@ -0,0 +1,41 @@
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <osmo-bts/gsm_data.h>
+#include <osmo-bts/rsl.h>
+#include <osmo-bts/oml.h>
+#include <osmo-bts/bts_model.h>
+
+int bts_model_rsl_chan_act(struct gsm_lchan *lchan, struct tlv_parsed *tp)
+{
+	uint8_t mode = *TLVP_VAL(tp, RSL_IE_CHAN_MODE);
+	uint8_t type = *TLVP_VAL(tp, RSL_IE_ACT_TYPE);
+
+	lchan_activate(lchan);
+	/* FIXME: only do this in case of success */
+
+	return rsl_tx_chan_act_ack(lchan, bts_model_get_time(lchan->ts->trx->bts));
+}
+
+int bts_model_rsl_chan_rel(struct gsm_lchan *lchan)
+{
+	lchan_deactivate(lchan);
+	return rsl_tx_rf_rel_ack(lchan);
+}
diff --git a/src/osmo-bts-sysmo/femtobts.c b/src/osmo-bts-sysmo/femtobts.c
new file mode 100644
index 00000000..ed22327c
--- /dev/null
+++ b/src/osmo-bts-sysmo/femtobts.c
@@ -0,0 +1,186 @@
+/* sysmocom femtobts L1 API related definitions */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "femtobts.h"
+
+const enum l1prim_type femtobts_l1prim_type[GsmL1_PrimId_NUM] = {
+	[GsmL1_PrimId_MphInitReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphCloseReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphConnectReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphDisconnectReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphActivateReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphDeactivateReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphConfigReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphMeasureReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_MphInitCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphCloseCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphConnectCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphDisconnectCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphActivateCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphDeactivateCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphConfigCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphMeasureCnf]	= L1P_T_CONF,
+	[GsmL1_PrimId_MphTimeInd]	= L1P_T_IND,
+	[GsmL1_PrimId_MphSyncInd]	= L1P_T_IND,
+	[GsmL1_PrimId_PhEmptyFrameReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_PhDataReq]	= L1P_T_REQ,
+	[GsmL1_PrimId_PhConnectInd]	= L1P_T_IND,
+	[GsmL1_PrimId_PhReadyToSendInd]	= L1P_T_IND,
+	[GsmL1_PrimId_PhDataInd]	= L1P_T_IND,
+	[GsmL1_PrimId_PhRaInd]		= L1P_T_IND,
+};
+
+const struct value_string femtobts_l1prim_names[GsmL1_PrimId_NUM+1] = {
+	{ GsmL1_PrimId_MphInitReq,	"MPH-INIT.req" },
+	{ GsmL1_PrimId_MphCloseReq,	"MPH-CLOSE.req" },
+	{ GsmL1_PrimId_MphConnectReq,	"MPH-CONNECT.req" },
+	{ GsmL1_PrimId_MphDisconnectReq,"MPH-DISCONNECT.req" },
+	{ GsmL1_PrimId_MphActivateReq,	"MPH-ACTIVATE.req" },
+	{ GsmL1_PrimId_MphDeactivateReq,"MPH-DEACTIVATE.req" },
+	{ GsmL1_PrimId_MphConfigReq,	"MPH-CONFIG.req" },
+	{ GsmL1_PrimId_MphMeasureReq,	"MPH-MEASURE.req" },
+	{ GsmL1_PrimId_MphInitCnf,	"MPH-INIT.conf" },
+	{ GsmL1_PrimId_MphCloseCnf,	"MPH-CLOSE.conf" },
+	{ GsmL1_PrimId_MphConnectCnf,	"MPH-CONNECT.conf" },
+	{ GsmL1_PrimId_MphDisconnectCnf,"MPH-DISCONNECT.conf" },
+	{ GsmL1_PrimId_MphActivateCnf,	"MPH-ACTIVATE.conf" },
+	{ GsmL1_PrimId_MphDeactivateCnf,"MPH-DEACTIVATE.conf" },
+	{ GsmL1_PrimId_MphConfigCnf,	"MPH-CONFIG.conf" },
+	{ GsmL1_PrimId_MphMeasureCnf,	"MPH-MEASURE.conf" },
+	{ GsmL1_PrimId_MphTimeInd,	"MPH-TIME.ind" },
+	{ GsmL1_PrimId_MphSyncInd,	"MPH-SYNC.ind" },
+	{ GsmL1_PrimId_PhEmptyFrameReq,	"PH-EMPTY_FRAME.req" },
+	{ GsmL1_PrimId_PhDataReq,	"PH-DATA.req" },
+	{ GsmL1_PrimId_PhConnectInd,	"PH-CONNECT.ind" },
+	{ GsmL1_PrimId_PhReadyToSendInd,"PH-READY_TO_SEND.ind" },
+	{ GsmL1_PrimId_PhDataInd,	"PH-DATA.ind" },
+	{ GsmL1_PrimId_PhRaInd,		"PH-RA.ind" },
+	{ 0, NULL }
+};
+
+const GsmL1_PrimId_t femtobts_l1prim_req2conf[GsmL1_PrimId_NUM] = {
+	[GsmL1_PrimId_MphInitReq]	= GsmL1_PrimId_MphInitCnf,
+	[GsmL1_PrimId_MphCloseReq]	= GsmL1_PrimId_MphCloseCnf,
+	[GsmL1_PrimId_MphConnectReq]	= GsmL1_PrimId_MphConnectCnf,
+	[GsmL1_PrimId_MphDisconnectReq]	= GsmL1_PrimId_MphDisconnectCnf,
+	[GsmL1_PrimId_MphActivateReq]	= GsmL1_PrimId_MphActivateCnf,
+	[GsmL1_PrimId_MphDeactivateReq]	= GsmL1_PrimId_MphDeactivateCnf,
+	[GsmL1_PrimId_MphConfigReq]	= GsmL1_PrimId_MphConfigCnf,
+	[GsmL1_PrimId_MphMeasureReq]	= GsmL1_PrimId_MphMeasureCnf,
+};
+
+const enum l1prim_type femtobts_sysprim_type[FemtoBts_PrimId_NUM] = {
+	[FemtoBts_PrimId_SystemInfoReq]		= L1P_T_REQ,
+	[FemtoBts_PrimId_SystemInfoCnf]		= L1P_T_CONF,
+	[FemtoBts_PrimId_SystemFailureInd]	= L1P_T_IND,
+	[FemtoBts_PrimId_ActivateRfReq]		= L1P_T_REQ,
+	[FemtoBts_PrimId_ActivateRfCnf]		= L1P_T_CONF,
+	[FemtoBts_PrimId_DeactivateRfReq]	= L1P_T_REQ,
+	[FemtoBts_PrimId_DeactivateRfCnf]	= L1P_T_CONF,
+	[FemtoBts_PrimId_SetTraceFlagsReq]	= L1P_T_REQ,
+	[FemtoBts_PrimId_RfClockInfoReq]	= L1P_T_REQ,
+	[FemtoBts_PrimId_RfClockInfoCnf]	= L1P_T_CONF,
+	[FemtoBts_PrimId_RfClockSetupReq]	= L1P_T_REQ,
+	[FemtoBts_PrimId_RfClockSetupCnf]	= L1P_T_CONF,
+	[FemtoBts_PrimId_Layer1ResetReq]	= L1P_T_REQ,
+	[FemtoBts_PrimId_Layer1ResetCnf]	= L1P_T_CONF,
+};
+
+const struct value_string femtobts_sysprim_names[FemtoBts_PrimId_NUM+1] = {
+	{ FemtoBts_PrimId_SystemInfoReq,	"SYSTEM-INFO.req" },
+	{ FemtoBts_PrimId_SystemInfoCnf,	"SYSTEM-INFO.conf" },
+	{ FemtoBts_PrimId_SystemFailureInd,	"SYSTEM-FAILURE.ind" },
+	{ FemtoBts_PrimId_ActivateRfReq,	"ACTIVATE-RF.req" },
+	{ FemtoBts_PrimId_ActivateRfCnf,	"ACTIVATE-RF.conf" },
+	{ FemtoBts_PrimId_DeactivateRfReq,	"DEACTIVATE-RF.req" },
+	{ FemtoBts_PrimId_DeactivateRfCnf,	"DEACTIVATE-RF.conf" },
+	{ FemtoBts_PrimId_SetTraceFlagsReq,	"SET-TRACE-FLAGS.req" },
+	{ FemtoBts_PrimId_RfClockInfoReq,	"RF-CLOCK-INFO.req" },
+	{ FemtoBts_PrimId_RfClockInfoCnf,	"RF-CLOCK-INFO.conf" },
+	{ FemtoBts_PrimId_RfClockSetupReq,	"RF-CLOCK-SETUP.req" },
+	{ FemtoBts_PrimId_RfClockSetupCnf,	"RF-CLOCK-SETUP.conf" },
+	{ FemtoBts_PrimId_Layer1ResetReq,	"LAYER1-RESET.req" },
+	{ FemtoBts_PrimId_Layer1ResetCnf,	"LAYER1-RESET.conf" },
+	{ 0, NULL }
+};
+
+const FemtoBts_PrimId_t femtobts_sysprim_req2conf[FemtoBts_PrimId_NUM] = {
+	[FemtoBts_PrimId_SystemInfoReq]	= FemtoBts_PrimId_SystemInfoCnf,
+	[FemtoBts_PrimId_ActivateRfReq]	= FemtoBts_PrimId_ActivateRfCnf,
+	[FemtoBts_PrimId_DeactivateRfReq] = FemtoBts_PrimId_DeactivateRfCnf,
+	[FemtoBts_PrimId_RfClockInfoReq] = FemtoBts_PrimId_RfClockInfoCnf,
+	[FemtoBts_PrimId_RfClockSetupReq] = FemtoBts_PrimId_RfClockSetupCnf,
+	[FemtoBts_PrimId_Layer1ResetReq] = FemtoBts_PrimId_Layer1ResetCnf,
+};
+
+const struct value_string femtobts_l1sapi_names[GsmL1_Sapi_NUM+1] = {
+	{ GsmL1_Sapi_Fcch,	"FCCH" },
+	{ GsmL1_Sapi_Sch,	"SCH" },
+	{ GsmL1_Sapi_Sacch,	"SACCH" },
+	{ GsmL1_Sapi_Sdcch,	"SDCCH" },
+	{ GsmL1_Sapi_Bcch,	"BCCH" },
+	{ GsmL1_Sapi_Pch,	"PCH" },
+	{ GsmL1_Sapi_Agch,	"AGCH" },
+	{ GsmL1_Sapi_Cbch,	"CBCH" },
+	{ GsmL1_Sapi_Rach,	"RACH" },
+	{ GsmL1_Sapi_TchF,	"TCH/F" },
+	{ GsmL1_Sapi_FacchF,	"FACCH/F" },
+	{ GsmL1_Sapi_TchH,	"TCH/H" },
+	{ GsmL1_Sapi_FacchH,	"FACCH/H" },
+	{ GsmL1_Sapi_Nch,	"NCH" },
+	{ GsmL1_Sapi_Pdtch,	"PDTCH" },
+	{ GsmL1_Sapi_Pacch,	"PACCH" },
+	{ GsmL1_Sapi_Pbcch,	"PBCCH" },
+	{ GsmL1_Sapi_Pagch,	"PAGCH" },
+	{ GsmL1_Sapi_Ppch,	"PPCH" },
+	{ GsmL1_Sapi_Pnch,	"PNCH" },
+	{ GsmL1_Sapi_Ptcch,	"PTCCH" },
+	{ GsmL1_Sapi_Prach,	"PRACH" },
+	{ 0, NULL }
+};
+
+const struct value_string femtobts_l1status_names[GSML1_STATUS_NUM+1] = {
+	{ GsmL1_Status_Success,		"Success" },
+	{ GsmL1_Status_Generic,		"Generic error" },
+	{ GsmL1_Status_NoMemory,	"Not enough memory" },
+	{ GsmL1_Status_Timeout,		"Timeout" },
+	{ GsmL1_Status_InvalidParam,	"Invalid parameter" },
+	{ GsmL1_Status_Busy,		"Resource busy" },
+	{ GsmL1_Status_NoRessource,	"No more resources" },
+	{ GsmL1_Status_Uninitialized,	"Trying to use uninitialized resource" },
+	{ GsmL1_Status_NullInterface,	"Trying to call a NULL interface" },
+	{ GsmL1_Status_NullFctnPtr,	"Trying to call a NULL function ptr" },
+	{ GsmL1_Status_BadCrc,		"Bad CRC" },
+	{ GsmL1_Status_BadUsf,		"Bad USF" },
+	{ GsmL1_Status_InvalidCPS,	"Invalid CPS field" },
+	{ GsmL1_Status_UnexpectedBurst,	"Unexpected burst" },
+	{ GsmL1_Status_UnavailCodec,	"AMR codec is unavailable" },
+	{ GsmL1_Status_CriticalError,	"Critical error" },
+	{ GsmL1_Status_OverheatError,	"Overheat error" },
+	{ GsmL1_Status_DeviceError,	"Device error" },
+	{ GsmL1_Status_FacchError,	"FACCH / TCH order error" },
+	{ GsmL1_Status_AlreadyDeactivated, "Lchan already deactivated" },
+	{ GsmL1_Status_TxBurstFifoOvrn,	"FIFO overrun" },
+	{ GsmL1_Status_TxBurstFifoUndr,	"FIFO underrun" },
+	{ GsmL1_Status_NotSynchronized,	"Not synchronized" },
+	{ GsmL1_Status_Unsupported,	"Unsupported feature" },
+	{ 0, NULL }
+};
diff --git a/src/osmo-bts-sysmo/femtobts.h b/src/osmo-bts-sysmo/femtobts.h
new file mode 100644
index 00000000..3a5beca6
--- /dev/null
+++ b/src/osmo-bts-sysmo/femtobts.h
@@ -0,0 +1,28 @@
+#ifndef FEMTOBTS_H
+#define FEMTOBTS_H
+
+#include <stdlib.h>
+#include <osmocom/core/utils.h>
+
+#include <sysmocom/femtobts/femtobts.h>
+#include <sysmocom/femtobts/gsml1const.h>
+
+enum l1prim_type {
+	L1P_T_REQ,
+	L1P_T_CONF,
+	L1P_T_IND,
+};
+
+
+const enum l1prim_type femtobts_l1prim_type[GsmL1_PrimId_NUM];
+const struct value_string femtobts_l1prim_names[GsmL1_PrimId_NUM+1];
+const GsmL1_PrimId_t femtobts_l1prim_req2conf[GsmL1_PrimId_NUM];
+
+const enum l1prim_type femtobts_sysprim_type[FemtoBts_PrimId_NUM];
+const struct value_string femtobts_sysprim_names[FemtoBts_PrimId_NUM+1];
+const FemtoBts_PrimId_t femtobts_sysprim_req2conf[FemtoBts_PrimId_NUM];
+
+const struct value_string femtobts_l1sapi_names[GsmL1_Sapi_NUM+1];
+const struct value_string femtobts_l1status_names[GSML1_STATUS_NUM+1];
+
+#endif /* FEMTOBTS_H */
diff --git a/src/osmo-bts-sysmo/l1_fwd.h b/src/osmo-bts-sysmo/l1_fwd.h
new file mode 100644
index 00000000..0c355499
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_fwd.h
@@ -0,0 +1,3 @@
+#define L1FWD_L1_PORT	9999
+#define L1FWD_SYS_PORT	9998
+
diff --git a/src/osmo-bts-sysmo/l1_fwd_main.c b/src/osmo-bts-sysmo/l1_fwd_main.c
new file mode 100644
index 00000000..c7bdcdf5
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_fwd_main.c
@@ -0,0 +1,205 @@
+/* Sysmocom femtobts L1 proxy */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+
+#include <arpa/inet.h>
+#include <netinet/in.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/core/logging.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <osmo-bts/logging.h>
+#include <osmo-bts/gsm_data.h>
+
+#include <sysmocom/femtobts/femtobts.h>
+#include <sysmocom/femtobts/gsml1prim.h>
+#include <sysmocom/femtobts/gsml1const.h>
+#include <sysmocom/femtobts/gsml1types.h>
+
+#include "femtobts.h"
+#include "l1_if.h"
+#include "l1_fwd.h"
+
+static const uint16_t fwd_udp_ports[_NUM_MQ_WRITE] = {
+	[MQ_SYS_READ]	= L1FWD_SYS_PORT,
+	[MQ_L1_READ]	= L1FWD_L1_PORT,
+};
+
+struct l1fwd_hdl {
+	struct sockaddr_storage remote_sa;
+	socklen_t remote_sa_len;
+
+	struct osmo_wqueue udp_wq[_NUM_MQ_WRITE];
+
+	struct femtol1_hdl *fl1h;
+};
+
+
+/* callback when there's a new L1 primitive coming in from the HW */
+int l1if_handle_l1prim(struct femtol1_hdl *fl1h, struct msgb *msg)
+{
+	struct l1fwd_hdl *l1fh = fl1h->priv;
+
+	/* Enqueue message to UDP socket */
+	return osmo_wqueue_enqueue(&l1fh->udp_wq[MQ_L1_WRITE], msg);
+}
+
+/* callback when there's a new SYS primitive coming in from the HW */
+int l1if_handle_sysprim(struct femtol1_hdl *fl1h, struct msgb *msg)
+{
+	struct l1fwd_hdl *l1fh = fl1h->priv;
+
+	/* Enqueue message to UDP socket */
+	return osmo_wqueue_enqueue(&l1fh->udp_wq[MQ_SYS_WRITE], msg);
+}
+
+
+/* data has arrived on the udp socket */
+static int udp_read_cb(struct osmo_fd *ofd)
+{
+	struct msgb *msg = msgb_alloc_headroom(2048, 128, "udp_rx");
+	struct l1fwd_hdl *l1fh = ofd->data;
+	struct femtol1_hdl *fl1h = l1fh->fl1h;
+	int rc;
+
+	if (!msg)
+		return -ENOMEM;
+
+	msg->l1h = msg->data;
+
+	l1fh->remote_sa_len = sizeof(l1fh->remote_sa);
+	rc = recvfrom(ofd->fd, msg->l1h, msgb_tailroom(msg), 0,
+		      (struct sockaddr *) &l1fh->remote_sa, &l1fh->remote_sa_len);
+	if (rc < 0) {
+		perror("read from udp");
+		msgb_free(msg);
+		return rc;
+	} else if (rc == 0) {
+		perror("len=0 read from udp");
+		msgb_free(msg);	
+		return rc;
+	}
+	msgb_put(msg, rc);
+
+	DEBUGP(DL1C, "UDP: Received %u bytes for %s queue\n", rc,
+		ofd->priv_nr == MQ_SYS_WRITE ? "SYS" : "L1");
+
+	/* put the message into the right queue */
+	if (ofd->priv_nr == MQ_SYS_WRITE)
+		rc = osmo_wqueue_enqueue(&fl1h->write_q[MQ_SYS_WRITE], msg);
+	else
+		rc = osmo_wqueue_enqueue(&fl1h->write_q[MQ_L1_WRITE], msg);
+	
+	return rc;
+}
+
+/* callback when we can write to the UDP socket */
+static int udp_write_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	int rc;
+	struct l1fwd_hdl *l1fh = ofd->data;
+
+	DEBUGP(DL1C, "UDP: Writing %u bytes for %s queue\n", msgb_l1len(msg),
+		ofd->priv_nr == MQ_SYS_WRITE ? "SYS" : "L1");
+
+	rc = sendto(ofd->fd, msg->l1h, msgb_l1len(msg), 0,
+		    (const struct sockaddr *)&l1fh->remote_sa, l1fh->remote_sa_len);
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "error writing to L1 msg_queue: %s\n",
+			strerror(errno));
+		return rc;
+	} else if (rc < msgb_l1len(msg)) {
+		LOGP(DL1C, LOGL_ERROR, "short write to L1 msg_queue: "
+			"%u < %u\n", rc, msgb_l1len(msg));
+		return -EIO;
+	}
+
+	return 0;
+}
+
+int main(int argc, char **argv)
+{
+	struct l1fwd_hdl *l1fh;
+	struct femtol1_hdl *fl1h;
+	int rc, i;
+
+	printf("sizeof(GsmL1_Prim_t) = %lu\n", sizeof(GsmL1_Prim_t));
+	printf("sizeof(FemtoBts_Prim_t) = %lu\n", sizeof(FemtoBts_Prim_t));
+
+	bts_log_init(NULL);
+
+	/* allocate new femtol1_handle */
+	fl1h = talloc_zero(NULL, struct femtol1_hdl);
+	INIT_LLIST_HEAD(&fl1h->wlc_list);
+
+	/* open the actual hardware transport */
+	rc = l1if_transport_open(fl1h);
+	if (rc < 0)
+		exit(1);
+
+	/* create our fwd handle */
+	l1fh = talloc_zero(NULL, struct l1fwd_hdl);
+
+	l1fh->fl1h = fl1h;
+	fl1h->priv = l1fh;
+
+	/* Open UDP */
+	for (i = 0; i < 2; i++) {
+		struct osmo_wqueue *wq = &l1fh->udp_wq[i];
+
+		osmo_wqueue_init(wq, 10);
+		wq->write_cb = udp_write_cb;
+		wq->read_cb = udp_read_cb;
+
+		wq->bfd.when |= BSC_FD_READ;
+		wq->bfd.data = l1fh;
+		wq->bfd.priv_nr = i;
+		rc = osmo_sock_init_ofd(&wq->bfd, AF_UNSPEC, SOCK_DGRAM,
+					IPPROTO_UDP, NULL, fwd_udp_ports[i],
+					OSMO_SOCK_F_BIND);
+		if (rc < 0) {
+			perror("sock_init");
+			exit(1);
+		}
+	}
+
+	while (1) {
+		rc = osmo_select_main(0);		
+		if (rc < 0) {
+			perror("select");
+			exit(1);
+		}
+	}
+	exit(0);
+}
diff --git a/src/osmo-bts-sysmo/l1_if.c b/src/osmo-bts-sysmo/l1_if.c
new file mode 100644
index 00000000..8f4b80f6
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_if.c
@@ -0,0 +1,622 @@
+/* Interface handler for Sysmocom L1 */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/timer.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/gsm/gsm_utils.h>
+#include <osmocom/gsm/lapdm.h>
+
+#include <osmo-bts/logging.h>
+#include <osmo-bts/bts.h>
+#include <osmo-bts/gsm_data.h>
+#include <osmo-bts/paging.h>
+
+#include <sysmocom/femtobts/femtobts.h>
+#include <sysmocom/femtobts/gsml1prim.h>
+#include <sysmocom/femtobts/gsml1const.h>
+#include <sysmocom/femtobts/gsml1types.h>
+
+#include "femtobts.h"
+#include "l1_if.h"
+#include "l1_transp.h"
+
+/* FIXME: make threshold configurable */
+#define MIN_QUAL_RACH	-1.0f	/* at least -1 dB C/I */
+#define MIN_QUAL_NORM	-1.0f	/* at least -1 dB C/I */
+
+struct wait_l1_conf {
+	struct llist_head list;		/* internal linked list */
+	struct osmo_timer_list timer;	/* timer for L1 timeout */
+	unsigned int conf_prim_id;	/* primitive we expect in response */
+	unsigned int is_sys_prim;	/* is this a system (1) or L1 (0) primitive */
+	l1if_compl_cb *cb;
+	void *cb_data;
+};
+
+static void release_wlc(struct wait_l1_conf *wlc)
+{
+	osmo_timer_del(&wlc->timer);
+	talloc_free(wlc);
+}
+
+static void l1if_req_timeout(void *data)
+{
+	struct wait_l1_conf *wlc = data;
+
+	if (wlc->is_sys_prim)
+		LOGP(DL1C, LOGL_FATAL, "Timeout waiting for SYS primitive %s\n",
+			get_value_string(femtobts_sysprim_names, wlc->conf_prim_id));
+	else
+		LOGP(DL1C, LOGL_FATAL, "Timeout waiting for L1 primitive %s\n",
+			get_value_string(femtobts_l1prim_names, wlc->conf_prim_id));
+	exit(23);
+}
+
+/* send a request primitive to the L1 and schedule completion call-back */
+int l1if_req_compl(struct femtol1_hdl *fl1h, struct msgb *msg,
+		   int is_system_prim, l1if_compl_cb *cb, void *data)
+{
+	struct wait_l1_conf *wlc;
+	struct osmo_wqueue *wqueue;
+	unsigned int timeout_secs;
+
+	/* allocate new wsc and store reference to mutex and conf_id */
+	wlc = talloc_zero(fl1h, struct wait_l1_conf);
+	wlc->cb = cb;
+	wlc->cb_data = data;
+
+	/* Make sure we actually have received a REQUEST type primitive */
+	if (is_system_prim == 0) {
+		GsmL1_Prim_t *l1p = msgb_l1prim(msg);
+
+		LOGP(DL1C, LOGL_DEBUG, "Tx L1 prim %s\n",
+			get_value_string(femtobts_l1prim_names, l1p->id));
+
+		if (femtobts_l1prim_type[l1p->id] != L1P_T_REQ) {
+			LOGP(DL1C, LOGL_ERROR, "L1 Prim %s is not a Request!\n",
+				get_value_string(femtobts_l1prim_names, l1p->id));
+			talloc_free(wlc);
+			return -EINVAL;
+		}
+		wlc->is_sys_prim = 0;
+		wlc->conf_prim_id = femtobts_l1prim_req2conf[l1p->id];
+		wqueue = &fl1h->write_q[MQ_L1_WRITE];
+		timeout_secs = 10;
+	} else {
+		FemtoBts_Prim_t *sysp = msgb_sysprim(msg);
+
+		LOGP(DL1C, LOGL_DEBUG, "Tx SYS prim %s\n",
+			get_value_string(femtobts_sysprim_names, sysp->id));
+
+		if (femtobts_sysprim_type[sysp->id] != L1P_T_REQ) {
+			LOGP(DL1C, LOGL_ERROR, "SYS Prim %s is not a Request!\n",
+				get_value_string(femtobts_sysprim_names, sysp->id));
+			talloc_free(wlc);
+			return -EINVAL;
+		}
+		wlc->is_sys_prim = 1;
+		wlc->conf_prim_id = femtobts_sysprim_req2conf[sysp->id];
+		wqueue = &fl1h->write_q[MQ_SYS_WRITE];
+		timeout_secs = 30;
+	}
+
+	/* enqueue the message in the queue and add wsc to list */
+	osmo_wqueue_enqueue(wqueue, msg);
+	llist_add(&wlc->list, &fl1h->wlc_list);
+
+	/* schedule a timer for 10 seconds. If DSP fails to respond, we terminate */
+	wlc->timer.data = wlc;
+	wlc->timer.cb = l1if_req_timeout;
+	osmo_timer_schedule(&wlc->timer, timeout_secs, 0);
+
+	return 0;
+}
+
+/* allocate a msgb containing a GsmL1_Prim_t */
+struct msgb *l1p_msgb_alloc(void)
+{
+	struct msgb *msg = msgb_alloc(sizeof(GsmL1_Prim_t), "l1_prim");
+
+	if (msg)
+		msg->l1h = msgb_put(msg, sizeof(GsmL1_Prim_t));
+
+	return msg;
+}
+
+/* allocate a msgb containing a FemtoBts_Prim_t */
+struct msgb *sysp_msgb_alloc(void)
+{
+	struct msgb *msg = msgb_alloc(sizeof(FemtoBts_Prim_t), "sys_prim");
+
+	if (msg)
+		msg->l1h = msgb_put(msg, sizeof(FemtoBts_Prim_t));
+
+	return msg;
+}
+
+/* prepare a PH-DATA.req primitive in response to a PH-RTS.ind */
+static struct msgb *alloc_ph_data_req(GsmL1_PhReadyToSendInd_t *rts_ind)
+{
+	struct msgb *msg = l1p_msgb_alloc();
+	GsmL1_Prim_t *l1p = msgb_l1prim(msg);
+	GsmL1_PhDataReq_t *data_req = &l1p->u.phDataReq;
+
+	l1p->id = GsmL1_PrimId_PhDataReq;
+
+	/* copy fields from PH-RSS.ind */
+	data_req->hLayer1	= rts_ind->hLayer1;
+	data_req->u8Tn 		= rts_ind->u8Tn;
+	data_req->u32Fn		= rts_ind->u32Fn;
+	data_req->sapi		= rts_ind->sapi;
+	data_req->subCh		= rts_ind->subCh;
+	data_req->u8BlockNbr	= rts_ind->u8BlockNbr;
+
+	return msg;
+}
+
+/* obtain a ptr to the lapdm_channel for a given hLayer2 */
+static struct lapdm_channel *
+get_lapdm_chan_by_hl2(struct gsm_bts_trx *trx, uint32_t hLayer2)
+{
+	struct gsm_lchan *lchan;
+
+	lchan = l1if_hLayer2_to_lchan(trx, hLayer2);
+	if (!lchan)
+		return NULL;
+
+	return &lchan->lapdm_ch;
+}
+
+
+static const uint8_t fill_frame[GSM_MACBLOCK_LEN] = {
+	0x01, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B,
+	0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B, 0x2B,
+	0x2B, 0x2B, 0x2B
+};
+
+static int handle_ph_readytosend_ind(struct femtol1_hdl *fl1,
+				     GsmL1_PhReadyToSendInd_t *rts_ind)
+{
+	struct msgb *resp_msg = alloc_ph_data_req(rts_ind);
+	struct gsm_bts_trx *trx = fl1->priv;
+	struct gsm_bts *bts = trx->bts;
+	struct gsm_bts_role_bts *btsb = bts->role;
+	GsmL1_Prim_t *l1p = msgb_l1prim(resp_msg);
+	GsmL1_PhDataReq_t *data_req = &l1p->u.phDataReq;
+	GsmL1_MsgUnitParam_t *msu_param = &data_req->msgUnitParam;
+	struct lapdm_channel *lc;
+	struct lapdm_entity *le;
+	struct gsm_lchan *lchan;
+	struct gsm_time g_time;
+	uint32_t t3p;
+	uint8_t *si;
+	struct osmo_phsap_prim pp;
+	int rc;
+
+	gsm_fn2gsmtime(&g_time, rts_ind->u32Fn);
+
+	DEBUGP(DL1P, "Rx PH-RTS.ind %02u/%02u/%02u SAPI=%s\n",
+		g_time.t1, g_time.t2, g_time.t3,
+		get_value_string(femtobts_l1sapi_names, rts_ind->sapi));
+
+	/* copy over parameters from PH-RTS.ind into PH-DATA.req */
+	data_req->hLayer1 = rts_ind->hLayer1;
+	data_req->u8Tn = rts_ind->u8Tn;
+	data_req->u32Fn = rts_ind->u32Fn;
+	data_req->sapi = rts_ind->sapi;
+	data_req->subCh = rts_ind->subCh;
+	data_req->u8BlockNbr = rts_ind->u8BlockNbr;
+	msu_param->u8Size = GSM_MACBLOCK_LEN;
+
+	switch (rts_ind->sapi) {
+	case GsmL1_Sapi_Sch:
+		/* compute T3prime */
+		t3p = (g_time.t3 - 1) / 10;
+		/* fill SCH burst with data */
+		msu_param->u8Size = 4;
+		msu_param->u8Buffer[0] = (bts->bsic << 2) | (g_time.t1 >> 9);
+		msu_param->u8Buffer[1] = (g_time.t1 >> 1);
+		msu_param->u8Buffer[2] = (g_time.t1 << 7) | (g_time.t2 << 2) | (t3p >> 1);
+		msu_param->u8Buffer[3] = (t3p & 1);
+		break;
+	case GsmL1_Sapi_Bcch:
+		/* get them from bts->si_buf[] */
+		si = bts_sysinfo_get(bts, &g_time);
+		if (si)
+			memcpy(msu_param->u8Buffer, si, GSM_MACBLOCK_LEN);
+		else
+			memcpy(msu_param->u8Buffer, fill_frame, GSM_MACBLOCK_LEN);
+		break;
+	case GsmL1_Sapi_Sacch:
+		/* resolve the L2 entity using rts_ind->hLayer2 */
+		lchan = l1if_hLayer2_to_lchan(trx, rts_ind->hLayer2);
+		le = &lchan->lapdm_ch.lapdm_acch;
+		rc = lapdm_phsap_dequeue_prim(le, &pp);
+		if (rc < 0) {
+			/* No SACCH data from LAPDM pending, send SACCH filling */
+			uint8_t *si = lchan_sacch_get(lchan, &g_time);
+			if (si) {
+				/* The +2 is empty space where the DSP inserts the L1 hdr */
+				memcpy(msu_param->u8Buffer+2, si, GSM_MACBLOCK_LEN-2);
+			} else
+				memcpy(msu_param->u8Buffer, fill_frame, GSM_MACBLOCK_LEN);
+		} else {
+			/* The +2 is empty space where the DSP inserts the L1 hdr */
+			memcpy(msu_param->u8Buffer+2, pp.oph.msg->data, GSM_MACBLOCK_LEN-2);
+			msgb_free(pp.oph.msg);
+		}
+		DEBUGP(DL1C, "Sending SACCH payload bytes: %s\n",
+			osmo_hexdump(msu_param->u8Buffer, GSM_MACBLOCK_LEN));
+		break;
+	case GsmL1_Sapi_Sdcch:
+		/* resolve the L2 entity using rts_ind->hLayer2 */
+		lc = get_lapdm_chan_by_hl2(trx, rts_ind->hLayer2);
+		le = &lc->lapdm_dcch;
+		rc = lapdm_phsap_dequeue_prim(le, &pp);
+		if (rc < 0)
+			memcpy(msu_param->u8Buffer, fill_frame, GSM_MACBLOCK_LEN);
+		else {
+			memcpy(msu_param->u8Buffer, pp.oph.msg->data, GSM_MACBLOCK_LEN);
+			msgb_free(pp.oph.msg);
+		}
+		break;
+	case GsmL1_Sapi_Agch:
+		/* special queue of messages from IMM ASS CMD */
+		{
+			struct msgb *msg = bts_agch_dequeue(bts);
+			if (!msg)
+				memcpy(msu_param->u8Buffer, fill_frame, GSM_MACBLOCK_LEN);
+			else {
+				DEBUGP(DL1C, "Sending AGCH payload %u bytes: %s\n",
+					msg->len, osmo_hexdump(msg->data, msg->len));
+				memcpy(msu_param->u8Buffer, msg->data, msg->len);
+				msgb_free(msg);
+			}
+		}
+		break;
+	case GsmL1_Sapi_Pch:
+		rc = paging_gen_msg(btsb->paging_state, msu_param->u8Buffer, &g_time);
+		/* FIXME: special paging logic */
+		break;
+	case GsmL1_Sapi_TchF:
+	case GsmL1_Sapi_FacchF:
+		/* we should never receive a request here */
+	default:
+		memcpy(msu_param->u8Buffer, fill_frame, GSM_MACBLOCK_LEN);
+		break;
+	}
+	/* transmit */
+	osmo_wqueue_enqueue(&fl1->write_q[MQ_L1_WRITE], resp_msg);
+
+	return 0;
+}
+
+static int handle_mph_time_ind(struct femtol1_hdl *fl1,
+				GsmL1_MphTimeInd_t *time_ind)
+{
+	/* Update our data structures with the current GSM time */
+	gsm_fn2gsmtime(&fl1->gsm_time, time_ind->u32Fn);
+
+	return 0;
+}
+
+/* determine LAPDm entity inside LAPDm channel for given L1 sapi */
+static struct lapdm_entity *le_by_l1_sapi(struct lapdm_channel *lc, GsmL1_Sapi_t sapi)
+{
+	switch (sapi) {
+	case GsmL1_Sapi_Sacch:
+		return &lc->lapdm_acch;
+	default:
+		return &lc->lapdm_dcch;
+	}
+}
+
+static uint8_t gen_link_id(GsmL1_Sapi_t l1_sapi, uint8_t lapdm_sapi)
+{
+	uint8_t c_bits = 0;
+
+	if (l1_sapi == GsmL1_Sapi_Sacch)
+		c_bits = 0x40;
+
+	return c_bits | (lapdm_sapi & 7);
+}
+
+static void dump_meas_res(GsmL1_MeasParam_t *m)
+{
+	DEBUGPC(DL1C, ", Meas: RSSI %-3.2f dBm,  Qual %-3.2f dB,  "
+		"BER %-3.2f,  Timing %d\n", m->fRssi, m->fLinkQuality,
+		m->fBer, m->i16BurstTiming);
+}
+
+static int handle_ph_data_ind(struct femtol1_hdl *fl1, GsmL1_PhDataInd_t *data_ind)
+{
+	struct osmo_phsap_prim pp;
+	struct gsm_lchan *lchan;
+	struct lapdm_entity *le;
+	struct msgb *msg;
+#warning Properly determine the SAPI here
+	uint8_t lapdm_sapi = 0;
+
+	if (data_ind->measParam.fLinkQuality < MIN_QUAL_NORM)
+		return 0;
+
+	DEBUGP(DL1C, "Rx PH-DATA.ind (hLayer2 = 0x%08x)", data_ind->hLayer2);
+	dump_meas_res(&data_ind->measParam);
+
+	lchan = l1if_hLayer2_to_lchan(fl1->priv, data_ind->hLayer2);
+	if (!lchan) {
+		LOGP(DL1C, LOGL_ERROR, "unable to resolve lchan by hLayer2\n");
+		return -ENODEV;
+	}
+
+	le = le_by_l1_sapi(&lchan->lapdm_ch, data_ind->sapi);
+
+	msg = msgb_alloc_headroom(128, 64, "PH-DATA.ind");
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_DATA,
+			PRIM_OP_INDICATION, msg);
+
+	msg->l2h = msgb_put(msg, data_ind->msgUnitParam.u8Size);
+	memcpy(msg->l2h, data_ind->msgUnitParam.u8Buffer,
+		data_ind->msgUnitParam.u8Size);
+
+	/* FIXME: LAPDm shouldn't really need those... */
+	pp.u.data.chan_nr = gsm_lchan2chan_nr(lchan);
+	pp.u.data.link_id = gen_link_id(data_ind->sapi, lapdm_sapi);
+
+	return lapdm_phsap_up(&pp.oph, le);
+}
+
+
+static int handle_ph_ra_ind(struct femtol1_hdl *fl1, GsmL1_PhRaInd_t *ra_ind)
+{
+	struct osmo_phsap_prim pp;
+	struct lapdm_channel *lc;
+
+	if (ra_ind->measParam.fLinkQuality < MIN_QUAL_RACH)
+		return 0;
+
+	DEBUGP(DL1C, "Rx PH-RA.ind");
+	dump_meas_res(&ra_ind->measParam);
+
+	lc = get_lapdm_chan_by_hl2(fl1->priv, ra_ind->hLayer2);
+	if (!lc) {
+		LOGP(DL1C, LOGL_ERROR, "unable to resolve LAPD channel by hLayer2\n");
+		return -ENODEV;
+	}
+
+	osmo_prim_init(&pp.oph, SAP_GSM_PH, PRIM_PH_RACH,
+			PRIM_OP_INDICATION, NULL);
+
+	pp.u.rach_ind.ra = ra_ind->msgUnitParam.u8Buffer[0];
+	pp.u.rach_ind.fn = ra_ind->u32Fn;
+	/* FIXME: check for under/overflow / sign */
+	if (ra_ind->measParam.i16BurstTiming <= 0 ||
+	    ra_ind->measParam.i16BurstTiming > 63 * 4)
+		pp.u.rach_ind.acc_delay = 0;
+	else
+		pp.u.rach_ind.acc_delay = ra_ind->measParam.i16BurstTiming >> 2;
+
+	return lapdm_phsap_up(&pp.oph, &lc->lapdm_dcch);
+}
+
+/* handle any random indication from the L1 */
+static int l1if_handle_ind(struct femtol1_hdl *fl1, struct msgb *msg)
+{
+	GsmL1_Prim_t *l1p = msgb_l1prim(msg);
+	int rc = 0;
+
+	switch (l1p->id) {
+	case GsmL1_PrimId_MphTimeInd:
+		rc = handle_mph_time_ind(fl1, &l1p->u.mphTimeInd);
+		break;
+	case GsmL1_PrimId_MphSyncInd:
+		break;
+	case GsmL1_PrimId_PhConnectInd:
+		break;
+	case GsmL1_PrimId_PhReadyToSendInd:
+		rc = handle_ph_readytosend_ind(fl1, &l1p->u.phReadyToSendInd);
+		break;
+	case GsmL1_PrimId_PhDataInd:
+		rc = handle_ph_data_ind(fl1, &l1p->u.phDataInd);
+		break;
+	case GsmL1_PrimId_PhRaInd:
+		rc = handle_ph_ra_ind(fl1, &l1p->u.phRaInd);
+		break;
+	default:
+		break;
+	}
+
+	msgb_free(msg);
+	return rc;
+}
+
+int l1if_handle_l1prim(struct femtol1_hdl *fl1h, struct msgb *msg)
+{
+	GsmL1_Prim_t *l1p = msgb_l1prim(msg);
+	struct wait_l1_conf *wlc;
+	int rc;
+
+	switch (l1p->id) {
+	case GsmL1_PrimId_MphTimeInd:
+		/* silent, don't clog the log file */
+		break;
+	default:
+		LOGP(DL1P, LOGL_DEBUG, "Rx L1 prim %s\n",
+			get_value_string(femtobts_l1prim_names, l1p->id));
+	}
+
+	/* check if this is a resposne to a sync-waiting request */
+	llist_for_each_entry(wlc, &fl1h->wlc_list, list) {
+		/* the limitation here is that we cannot have multiple callers
+		 * sending the same primitive */
+		if (wlc->is_sys_prim == 0 && l1p->id == wlc->conf_prim_id) {
+			llist_del(&wlc->list);
+			rc = wlc->cb(msg, wlc->cb_data);
+			release_wlc(wlc);
+			return rc;
+		}
+	}
+
+	/* if we reach here, it is not a Conf for a pending Req */
+	return l1if_handle_ind(fl1h, msg);
+}
+
+int l1if_handle_sysprim(struct femtol1_hdl *fl1h, struct msgb *msg)
+{
+	FemtoBts_Prim_t *sysp = msgb_sysprim(msg);
+	struct wait_l1_conf *wlc;
+	int rc;
+
+	LOGP(DL1P, LOGL_DEBUG, "Rx SYS prim %s\n",
+		get_value_string(femtobts_sysprim_names, sysp->id));
+
+	/* check if this is a resposne to a sync-waiting request */
+	llist_for_each_entry(wlc, &fl1h->wlc_list, list) {
+		/* the limitation here is that we cannot have multiple callers
+		 * sending the same primitive */
+		if (wlc->is_sys_prim && sysp->id == wlc->conf_prim_id) {
+			llist_del(&wlc->list);
+			rc = wlc->cb(msg, wlc->cb_data);
+			release_wlc(wlc);
+			return rc;
+		}
+	}
+	/* if we reach here, it is not a Conf for a pending Req */
+	return l1if_handle_ind(fl1h, msg);
+}
+
+#if 0
+/* called by RSL if the BCCH SI has been modified */
+int sysinfo_has_changed(struct gsm_bts *bts, int si)
+{
+	/* FIXME: Determine BS_AG_BLKS_RES and 
+	 *  	* set cfgParams.u.agch.u8NbrOfAgch
+	 *	* determine implications on paging
+	 */
+	/* FIXME: Check for Extended BCCH presence */
+	/* FIXME: Check for CCCH_CONF */
+	/* FIXME: Check for BS_PA_MFRMS: update paging */
+
+	return 0;
+}
+#endif
+
+static int activate_rf_compl_cb(struct msgb *resp, void *data)
+{
+	FemtoBts_Prim_t *sysp = msgb_sysprim(resp);
+	GsmL1_Status_t status;
+	int on = 0;
+
+	if (sysp->id == FemtoBts_PrimId_ActivateRfCnf)
+		on = 1;
+
+	if (on)
+		status = sysp->u.activateRfCnf.status;
+	else
+		status = sysp->u.deactivateRfCnf.status;
+
+	LOGP(DL1C, LOGL_INFO, "Rx RF-%sACT.conf (status=%s)\n", on ? "" : "DE",
+		get_value_string(femtobts_l1status_names, status));
+
+	talloc_free(resp);
+
+	return 0;
+}
+
+int l1if_activate_rf(struct femtol1_hdl *hdl, int on)
+{
+	struct msgb *msg = sysp_msgb_alloc();
+	FemtoBts_Prim_t *sysp = msgb_sysprim(msg);
+
+	if (on) {
+		sysp->id = FemtoBts_PrimId_ActivateRfReq;
+		sysp->u.activateRfReq.u12ClkVc = 0xFFFF;
+	} else {
+		sysp->id = FemtoBts_PrimId_DeactivateRfReq;
+	}
+
+	return l1if_req_compl(hdl, msg, 1, activate_rf_compl_cb, hdl);
+}
+
+static int reset_compl_cb(struct msgb *resp, void *data)
+{
+	struct femtol1_hdl *fl1h = data;
+	FemtoBts_Prim_t *sysp = msgb_sysprim(resp);
+	GsmL1_Status_t status = sysp->u.layer1ResetCnf.status;
+
+	LOGP(DL1C, LOGL_NOTICE, "Rx L1-RESET.conf (status=%s)\n",
+		get_value_string(femtobts_l1status_names, status));
+
+	talloc_free(resp);
+
+	/* If we're coming out of reset .. */
+	if (status == GsmL1_Status_Success)
+		l1if_activate_rf(fl1h, 1);
+
+	return 0;
+}
+
+int l1if_reset(struct femtol1_hdl *hdl)
+{
+	struct msgb *msg = sysp_msgb_alloc();
+	FemtoBts_Prim_t *sysp = msgb_sysprim(msg);
+	sysp->id = FemtoBts_PrimId_Layer1ResetReq;
+
+	return l1if_req_compl(hdl, msg, 1, reset_compl_cb, hdl);
+}
+
+struct femtol1_hdl *l1if_open(void *priv)
+{
+	struct femtol1_hdl *fl1h;
+	int rc;
+
+	fl1h = talloc_zero(priv, struct femtol1_hdl);
+	if (!fl1h)
+		return NULL;
+	INIT_LLIST_HEAD(&fl1h->wlc_list);
+
+	fl1h->priv = priv;
+
+	rc = l1if_transport_open(fl1h);
+	if (rc < 0) {
+		talloc_free(fl1h);
+		return NULL;
+	}
+
+	return fl1h;
+}
+
+int l1if_close(struct femtol1_hdl *fl1h)
+{
+	return l1if_transport_close(fl1h);
+}
diff --git a/src/osmo-bts-sysmo/l1_if.h b/src/osmo-bts-sysmo/l1_if.h
new file mode 100644
index 00000000..7dcae537
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_if.h
@@ -0,0 +1,50 @@
+#ifndef _FEMTO_L1_H
+#define _FEMTO_L1_H
+
+#include <osmocom/core/select.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+enum {
+	MQ_SYS_READ,
+	MQ_L1_READ,
+	_NUM_MQ_READ
+};
+
+enum {
+	MQ_SYS_WRITE,
+	MQ_L1_WRITE,
+	_NUM_MQ_WRITE
+};
+
+struct femtol1_hdl {
+	struct gsm_time gsm_time;
+	uint32_t hLayer1;			/* handle to the L1 instance in the DSP */
+	struct llist_head wlc_list;
+
+	void *priv;			/* user reference */
+
+	struct osmo_fd read_ofd[_NUM_MQ_READ];	/* osmo file descriptors */
+	struct osmo_wqueue write_q[_NUM_MQ_WRITE];
+};
+
+#define msgb_l1prim(msg)	((GsmL1_Prim_t *)(msg)->l1h)
+#define msgb_sysprim(msg)	((FemtoBts_Prim_t *)(msg)->l1h)
+
+typedef int l1if_compl_cb(struct msgb *l1_msg, void *data);
+
+/* send a request primitive to the L1 and schedule completion call-back */
+int l1if_req_compl(struct femtol1_hdl *fl1h, struct msgb *msg,
+		   int is_system_prim, l1if_compl_cb *cb, void *data);
+
+struct femtol1_hdl *l1if_open(void *priv);
+int l1if_close(struct femtol1_hdl *hdl);
+int l1if_reset(struct femtol1_hdl *hdl);
+
+struct msgb *l1p_msgb_alloc(void);
+struct msgb *sysp_msgb_alloc(void);
+
+uint32_t l1if_lchan_to_hLayer2(struct gsm_lchan *lchan);
+struct gsm_lchan *l1if_hLayer2_to_lchan(struct gsm_bts_trx *trx, uint32_t hLayer2);
+
+#endif /* _FEMTO_L1_H */
diff --git a/src/osmo-bts-sysmo/l1_transp.h b/src/osmo-bts-sysmo/l1_transp.h
new file mode 100644
index 00000000..5226961d
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_transp.h
@@ -0,0 +1,14 @@
+#ifndef _FEMTOL1_TRANSPH_
+#define _FEMTOL1_TRANSPH_
+
+#include <osmocom/core/msgb.h>
+
+/* functions a transport calls on arrival of primitive from BTS */
+int l1if_handle_l1prim(struct femtol1_hdl *fl1h, struct msgb *msg);
+int l1if_handle_sysprim(struct femtol1_hdl *fl1h, struct msgb *msg);
+
+/* functions exported by a transport */
+int l1if_transport_open(struct femtol1_hdl *fl1h);
+int l1if_transport_close(struct femtol1_hdl *fl1h);
+
+#endif /* _FEMTOL1_TRANSP_H */
diff --git a/src/osmo-bts-sysmo/l1_transp_fwd.c b/src/osmo-bts-sysmo/l1_transp_fwd.c
new file mode 100644
index 00000000..3d33751b
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_transp_fwd.c
@@ -0,0 +1,143 @@
+/* Interface handler for Sysmocom L1 (forwarding) */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/core/msgb.h>
+#include <osmocom/core/socket.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <osmo-bts/logging.h>
+#include <osmo-bts/gsm_data.h>
+
+#include <sysmocom/femtobts/femtobts.h>
+#include <sysmocom/femtobts/gsml1prim.h>
+#include <sysmocom/femtobts/gsml1const.h>
+#include <sysmocom/femtobts/gsml1types.h>
+
+#include "femtobts.h"
+#include "l1_if.h"
+#include "l1_transp.h"
+#include "l1_fwd.h"
+
+#define BTS_HOST "192.168.100.151"
+
+static const uint16_t fwd_udp_ports[] = {
+	[MQ_SYS_WRITE]	= L1FWD_SYS_PORT,
+	[MQ_L1_WRITE]	= L1FWD_L1_PORT,
+};
+
+static int fwd_read_cb(struct osmo_fd *ofd)
+{
+	struct msgb *msg = msgb_alloc_headroom(2048, 127, "udp_rx");
+	struct femtol1_hdl *fl1h = ofd->data;
+	int rc;
+
+	if (!msg)
+		return -ENOMEM;
+
+	msg->l1h = msg->data;
+	rc = read(ofd->fd, msg->l1h, msgb_tailroom(msg));
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "Short read from UDP\n");
+		msgb_free(msg);
+		return rc;
+	} else if (rc == 0) {
+		LOGP(DL1C, LOGL_ERROR, "Len=0 from UDP\n");
+		msgb_free(msg);
+		return rc;
+	}
+	msgb_put(msg, rc);
+
+	if (ofd->priv_nr == MQ_SYS_WRITE)
+		rc = l1if_handle_sysprim(fl1h, msg);
+	else
+		rc = l1if_handle_l1prim(fl1h, msg);
+
+	return rc;
+}
+
+static int prim_write_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	/* write to the fd */
+	return write(ofd->fd, msg->head, msg->len);
+}
+
+int l1if_transport_open(struct femtol1_hdl *fl1h)
+{
+	int rc, i;
+
+	printf("sizeof(GsmL1_Prim_t) = %lu\n", sizeof(GsmL1_Prim_t));
+	printf("sizeof(FemtoBts_Prim_t) = %lu\n", sizeof(FemtoBts_Prim_t));
+
+	for (i = 0; i < ARRAY_SIZE(fl1h->write_q); i++) {
+		struct osmo_wqueue *wq = &fl1h->write_q[i];
+		struct osmo_fd *ofd = &wq->bfd;
+
+		osmo_wqueue_init(wq, 10);
+		wq->write_cb = prim_write_cb;
+		wq->read_cb = fwd_read_cb;
+
+		ofd->data = fl1h;
+		ofd->priv_nr = i;
+		ofd->when |= BSC_FD_READ;
+
+		rc = osmo_sock_init_ofd(ofd, AF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP,
+					BTS_HOST, fwd_udp_ports[i],
+					OSMO_SOCK_F_CONNECT);
+		if (rc < 0) {
+			talloc_free(fl1h);
+			return rc;
+		}
+	}
+
+	return 0;
+}
+
+int l1if_transport_close(struct femtol1_hdl *fl1h)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(fl1h->write_q); i++) {
+		struct osmo_wqueue *wq = &fl1h->write_q[i];
+		struct osmo_fd *ofd = &wq->bfd;
+
+		osmo_wqueue_clear(wq);
+		osmo_fd_unregister(ofd);
+		close(ofd->fd);
+	}
+	
+	return 0;
+}
diff --git a/src/osmo-bts-sysmo/l1_transp_hw.c b/src/osmo-bts-sysmo/l1_transp_hw.c
new file mode 100644
index 00000000..d7e01e92
--- /dev/null
+++ b/src/osmo-bts-sysmo/l1_transp_hw.c
@@ -0,0 +1,192 @@
+/* Interface handler for Sysmocom L1 (real hardware) */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+#include <fcntl.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+#include <osmocom/core/select.h>
+#include <osmocom/core/write_queue.h>
+#include <osmocom/gsm/gsm_utils.h>
+
+#include <osmo-bts/logging.h>
+#include <osmo-bts/gsm_data.h>
+
+#include <sysmocom/femtobts/femtobts.h>
+#include <sysmocom/femtobts/gsml1prim.h>
+#include <sysmocom/femtobts/gsml1const.h>
+#include <sysmocom/femtobts/gsml1types.h>
+
+#include "femtobts.h"
+#include "l1_if.h"
+#include "l1_transp.h"
+
+
+#define DEV_SYS_DSP2ARM_NAME	"/dev/msgq/femtobts_dsp2arm"
+#define DEV_SYS_ARM2DSP_NAME	"/dev/msgq/femtobts_arm2dsp"
+#define DEV_L1_DSP2ARM_NAME	"/dev/msgq/gsml1_dsp2arm"
+#define DEV_L1_ARM2DSP_NAME	"/dev/msgq/gsml1_arm2dsp"
+
+static const char *rd_devnames[] = {
+	[MQ_SYS_READ]	= DEV_SYS_DSP2ARM_NAME,
+	[MQ_L1_READ]	= DEV_L1_DSP2ARM_NAME,
+};
+
+static const char *wr_devnames[] = {
+	[MQ_SYS_WRITE]	= DEV_SYS_ARM2DSP_NAME,
+	[MQ_L1_WRITE]	= DEV_L1_ARM2DSP_NAME,
+};
+
+/* callback when there's something to read from the l1 msg_queue */
+static int l1if_fd_cb(struct osmo_fd *ofd, unsigned int what)
+{
+	//struct msgb *msg = l1p_msgb_alloc();
+	struct msgb *msg = msgb_alloc_headroom(2048, 128, "1l_fd");
+	struct femtol1_hdl *fl1h = ofd->data;
+	int rc;
+
+	msg->l1h = msg->data;
+	rc = read(ofd->fd, msg->l1h, sizeof(GsmL1_Prim_t));
+	if (rc < 0) {
+		if (rc != -1) 
+			LOGP(DL1C, LOGL_ERROR, "error reading from L1 msg_queue: %s\n",
+				strerror(errno));
+		msgb_free(msg);
+		return rc;
+	}
+	msgb_put(msg, rc);
+
+	if (ofd->priv_nr == MQ_L1_WRITE)
+		return l1if_handle_l1prim(fl1h, msg);
+	else
+		return l1if_handle_sysprim(fl1h, msg);
+};
+
+/* callback when we can write to one of the l1 msg_queue devices */
+static int l1fd_write_cb(struct osmo_fd *ofd, struct msgb *msg)
+{
+	int rc;
+
+	rc = write(ofd->fd, msg->l1h, msgb_l1len(msg));
+	if (rc < 0) {
+		LOGP(DL1C, LOGL_ERROR, "error writing to L1 msg_queue: %s\n",
+			strerror(errno));
+		return rc;
+	} else if (rc < msg->len) {
+		LOGP(DL1C, LOGL_ERROR, "short write to L1 msg_queue: "
+			"%u < %u\n", rc, msg->len);
+		return -EIO;
+	}
+
+	return 0;
+}
+
+int l1if_transport_open(struct femtol1_hdl *hdl)
+{
+	int rc, i;
+
+	/* Step 1: Open all msg_queue file descriptors */
+	for (i = 0; i < ARRAY_SIZE(hdl->read_ofd); i++) {
+		struct osmo_fd *ofd = &hdl->read_ofd[i];
+
+		rc = open(rd_devnames[i], O_RDONLY);
+		if (rc < 0) {
+			LOGP(DL1C, LOGL_FATAL, "unable to open msg_queue: %s\n",
+				strerror(errno));
+			goto out_free;
+		}
+		ofd->fd = rc;
+		ofd->priv_nr = i;
+		ofd->data = hdl;
+		ofd->cb = l1if_fd_cb;
+		ofd->when = BSC_FD_READ;
+		rc = osmo_fd_register(ofd);
+		if (rc < 0) {
+			close(ofd->fd);
+			ofd->fd = -1;
+			goto out_free;
+		}
+	}
+	for (i = 0; i < ARRAY_SIZE(hdl->write_q); i++) {
+		struct osmo_wqueue *wq = &hdl->write_q[i];
+		struct osmo_fd *ofd = &hdl->write_q[i].bfd;
+
+		rc = open(wr_devnames[i], O_WRONLY);
+		if (rc < 0) {
+			LOGP(DL1C, LOGL_FATAL, "unable to open msg_queue: %s\n",
+				strerror(errno));
+			goto out_read;
+		}
+
+		osmo_wqueue_init(wq, 10);
+		wq->write_cb = l1fd_write_cb;
+
+		ofd->fd = rc;
+		ofd->priv_nr = i;
+		ofd->data = hdl;
+		ofd->when = BSC_FD_WRITE;
+		rc = osmo_fd_register(ofd);
+		if (rc < 0) {
+			close(ofd->fd);
+			ofd->fd = -1;
+			goto out_read;
+		}
+
+	}
+	return 0;
+
+out_read:
+	for (i = 0; i < ARRAY_SIZE(hdl->read_ofd); i++) {
+		close(hdl->read_ofd[i].fd);
+		osmo_fd_unregister(&hdl->read_ofd[i]);
+	}
+out_free:
+	talloc_free(hdl);
+	return rc;
+}
+
+int l1if_transport_close(struct femtol1_hdl *hdl)
+{
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(hdl->read_ofd); i++) {
+		struct osmo_fd *ofd = &hdl->read_ofd[i];
+
+		osmo_fd_unregister(ofd);
+		close(ofd->fd);
+		ofd->fd = -1;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(hdl->write_q); i++) {
+		struct osmo_fd *ofd = &hdl->write_q[i].bfd;
+
+		osmo_fd_unregister(ofd);
+		close(ofd->fd);
+		ofd->fd = -1;
+	}
+	return 0;
+}
diff --git a/src/osmo-bts-sysmo/lapdm_glue.c b/src/osmo-bts-sysmo/lapdm_glue.c
new file mode 100644
index 00000000..6f3505a6
--- /dev/null
+++ b/src/osmo-bts-sysmo/lapdm_glue.c
@@ -0,0 +1,54 @@
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+
+#include <osmocom/gsm/prim.h>
+
+#include <osmocom/bb/common/l1ctl.h>
+#include <osmocom/bb/common/lapdm.h>
+
+/* LAPDm wants to send a PH-* primitive to the physical layer (L1) */
+int sysmol1_ph_prim_cb(struct osmo_prim_hdr *oph, void *ctx)
+{
+	struct osmocom_ms *ms = ctx;
+	struct osmo_phsap_prim *pp = (struct osmo_phsap_prim *) oph;
+	int rc = 0;
+
+	if (oph->sap != SAP_GSM_PH)
+		return -ENODEV;
+
+	if (oph->operation != PRIM_OP_REQUEST)
+		return -EINVAL;
+
+	switch (oph->primitive) {
+	case PRIM_PH_RACH:
+		/* A BTS never transmits RACH */
+	case PRIM_PH_DATA:
+		/* we use the LAPDm code in polling only, we should never
+		 * get a PH-DATA.req */
+	default:
+		LOGP(DLAPDM, LOGL_ERROR, "LAPDm sends unknown prim %u\n",
+			oph->primitive);
+		rc = -EINVAL;
+		break;
+	}
+
+	return rc;
+}
diff --git a/src/osmo-bts-sysmo/main.c b/src/osmo-bts-sysmo/main.c
new file mode 100644
index 00000000..701b79a1
--- /dev/null
+++ b/src/osmo-bts-sysmo/main.c
@@ -0,0 +1,243 @@
+/* Main program for Sysmocom BTS */
+
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <getopt.h>
+#include <sys/signal.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/application.h>
+
+#include <osmo-bts/gsm_data.h>
+#include <osmo-bts/logging.h>
+#include <osmo-bts/abis.h>
+#include <osmo-bts/bts.h>
+#include <osmo-bts/vty.h>
+
+#include "l1_if.h"
+
+/* FIXME: read from real hardware */
+const uint8_t abis_mac[6] = { 0,1,2,3,4,5 };
+/* FIXME: generate from git */
+const char *software_version = "0815";
+
+static const char *bsc_host = NULL;
+static const char *config_file = "osmo-bts.cfg";
+extern const char *osmobts_copyright;
+static int daemonize = 0;
+
+int bts_model_init(struct gsm_bts *bts)
+{
+	struct femtol1_hdl *fl1h;
+
+	fl1h = l1if_open(bts->c0);
+	if (!fl1h) {
+		LOGP(DL1C, LOGL_FATAL, "Cannot open L1 Interface\n");
+		return -EIO;
+	}
+
+	bts->c0->role_bts.l1h = fl1h;
+
+	l1if_reset(fl1h);
+
+	return 0;
+}
+
+struct ipabis_link *link_init(struct gsm_bts *bts, const char *ip)
+{
+	struct ipabis_link *link = talloc_zero(bts, struct ipabis_link);
+	struct in_addr ia;
+	int rc;
+
+	inet_aton(ip, &ia);
+
+	link->bts = bts;
+	bts->oml_link = link;
+
+	rc = abis_open(link, ntohl(ia.s_addr));
+	if (rc < 0)
+		return NULL;
+
+	return link;
+}
+
+static void print_help()
+{
+	printf( "Some useful options:\n"
+		"  -h	--help		this text\n"
+		"  -d	--debug MASK	Enable debugging (e.g. -d DRSL:DOML:DLAPDM)\n"
+		"  -D	--daemonize	For the process into a background daemon\n"
+		"  -c	--config-file 	Specify the filename of the config file\n"
+		"  -s	--disable-color	Don't use colors in stderr log output\n"
+		"  -T	--timestamp	Prefix every log line with a timestamp\n"
+		"  -V	--version	Print version information and exit\n"
+		"  -e 	--log-level	Set a global log-level\n"
+		"  -B	--bsc-host	Specify host-name of the BSC\n"
+		);
+}
+
+/* FIXME: finally get some option parsing code into libosmocore */
+static void handle_options(int argc, char **argv)
+{
+	while (1) {
+		int option_idx = 0, c;
+		static const struct option long_options[] = {
+			/* FIXME: all those are generic Osmocom app options */
+			{ "help", 0, 0, 'h' },
+			{ "debug", 1, 0, 'd' },
+			{ "daemonize", 0, 0, 'D' },
+			{ "config-file", 1, 0, 'c' },
+			{ "disable-color", 0, 0, 's' },
+			{ "timestamp", 0, 0, 'T' },
+			{ "version", 0, 0, 'V' },
+			{ "log-level", 1, 0, 'e' },
+			{ "bsc-host", 1, 0, 'B' },
+			{ 0, 0, 0, 0 }
+		};
+
+		c = getopt_long(argc, argv, "hd:Dc:sTVe:B:",
+				long_options, &option_idx);
+		if (c == -1)
+			break;
+
+		switch (c) {
+		case 'h':
+			print_help();
+			exit(0);
+			break;
+		case 's':
+			log_set_use_color(osmo_stderr_target, 0);
+			break;
+		case 'd':
+			log_parse_category_mask(osmo_stderr_target, optarg);
+			break;
+		case 'D':
+			daemonize = 1;
+			break;
+		case 'c':
+			config_file = strdup(optarg);
+			break;
+		case 'T':
+			log_set_print_timestamp(osmo_stderr_target, 1);
+			break;
+		case 'V':
+			print_version(1);
+			exit(0);
+			break;
+		case 'e':
+			log_set_log_level(osmo_stderr_target, atoi(optarg));
+			break;
+		case 'B':
+			bsc_host = strdup(optarg);
+			break;
+		default:
+			break;
+		}
+	}
+}
+
+static void signal_handler(int signal)
+{
+	fprintf(stderr, "signal %u received\n", signal);
+
+	switch (signal) {
+	case SIGINT:
+		//osmo_signal_dispatch(SS_GLOBAL, S_GLOBAL_SHUTDOWN, NULL);
+		sleep(3);
+		exit(0);
+		break;
+	case SIGABRT:
+	case SIGUSR1:
+	case SIGUSR2:
+		talloc_report_full(tall_bts_ctx, stderr);
+		break;
+	default:
+		break;
+	}
+}
+
+int main(int argc, char **argv)
+{
+	struct gsm_bts *bts;
+	struct ipabis_link *link;
+	int rc;
+
+	tall_bts_ctx = talloc_named_const(NULL, 1, "OsmoBTS context");
+
+	bts_log_init(NULL);
+
+	bts = gsm_bts_alloc(tall_bts_ctx);
+
+	vty_init(&bts_vty_info);
+	//bts_vty_init(&
+
+	/* FIXME: parse config file */
+
+	rc = telnet_init(tall_bts_ctx, NULL, 4241);
+	if (rc < 0) {
+		fprintf(stderr, "Error initializing telnet\n");
+		exit(1);
+	}
+
+	handle_options(argc, argv);
+
+	if (!bsc_host) {
+		fprintf(stderr, "You need to specify the BSC hostname\n");
+		exit(2);
+	}
+
+	signal(SIGINT, &signal_handler);
+	signal(SIGABRT, &signal_handler);
+	signal(SIGUSR1, &signal_handler);
+	signal(SIGUSR2, &signal_handler);
+	osmo_init_ignore_signals();
+
+	if (bts_init(bts) < 0) {
+		fprintf(stderr, "unable to to open bts\n");
+		exit(1);
+	}
+
+	link = link_init(bts, bsc_host);
+	if (!link) {
+		fprintf(stderr, "unable to connect to BSC\n");
+		exit(1);
+	}
+	bts->oml_link = link;
+
+	if (daemonize) {
+		rc = osmo_daemonize();
+		if (rc < 0) {
+			perror("Error during daemonize");
+			exit(1);
+		}
+	}
+
+	while (1) {
+		log_reset_context();
+		osmo_select_main(0);
+	}
+}
diff --git a/src/osmo-bts-sysmo/oml.c b/src/osmo-bts-sysmo/oml.c
new file mode 100644
index 00000000..0c9183a4
--- /dev/null
+++ b/src/osmo-bts-sysmo/oml.c
@@ -0,0 +1,545 @@
+/* (C) 2011 by Harald Welte <laforge@gnumonks.org>
+ *
+ * All Rights Reserved
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include <stdint.h>
+
+#include <osmocom/core/talloc.h>
+#include <osmocom/core/utils.h>
+
+#include <sysmocom/femtobts/gsml1prim.h>
+#include <sysmocom/femtobts/gsml1const.h>
+#include <sysmocom/femtobts/gsml1types.h>
+
+#include <osmo-bts/gsm_data.h>
+#include <osmo-bts/logging.h>
+#include <osmo-bts/oml.h>
+
+#include "l1_if.h"
+#include "femtobts.h"
+
+static const enum GsmL1_LogChComb_t pchan_to_logChComb[_GSM_PCHAN_MAX] = {
+	[GSM_PCHAN_NONE]		= GsmL1_LogChComb_0,
+	[GSM_PCHAN_CCCH]		= GsmL1_LogChComb_IV,
+	[GSM_PCHAN_CCCH_SDCCH4] 	= GsmL1_LogChComb_V,
+	[GSM_PCHAN_TCH_F]		= GsmL1_LogChComb_I,
+	[GSM_PCHAN_TCH_H]		= GsmL1_LogChComb_II,
+	[GSM_PCHAN_SDCCH8_SACCH8C]	= GsmL1_LogChComb_VII,
+	[GSM_PCHAN_PDCH]		= GsmL1_LogChComb_XIII,
+	//[GSM_PCHAN_TCH_F_PDCH]		= FIXME,
+	[GSM_PCHAN_UNKNOWN]		= GsmL1_LogChComb_0,
+};
+
+static void *prim_init(GsmL1_Prim_t *prim, GsmL1_PrimId_t id, struct femtol1_hdl *gl1)
+{
+	prim->id = id;
+
+	/* for some reason the hLayer1 field is not always at the same position
+	 * in the GsmL1_Prim_t, so we have to have this ugly case statement here... */
+	switch (id) {
+	case GsmL1_PrimId_MphInitReq:
+		//prim->u.mphInitReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphCloseReq:
+		prim->u.mphCloseReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphConnectReq:
+		prim->u.mphConnectReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphDisconnectReq:
+		prim->u.mphDisconnectReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphActivateReq:
+		prim->u.mphActivateReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphDeactivateReq:
+		prim->u.mphDeactivateReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphConfigReq:
+		prim->u.mphConfigReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphMeasureReq:
+		prim->u.mphMeasureReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_MphInitCnf:
+	case GsmL1_PrimId_MphCloseCnf:
+	case GsmL1_PrimId_MphConnectCnf:
+	case GsmL1_PrimId_MphDisconnectCnf:
+	case GsmL1_PrimId_MphActivateCnf:
+	case GsmL1_PrimId_MphDeactivateCnf:
+	case GsmL1_PrimId_MphConfigCnf:
+	case GsmL1_PrimId_MphMeasureCnf:
+		break;
+	case GsmL1_PrimId_MphTimeInd:
+		break;
+	case GsmL1_PrimId_MphSyncInd:
+		break;
+	case GsmL1_PrimId_PhEmptyFrameReq:
+		prim->u.phEmptyFrameReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_PhDataReq:
+		prim->u.phDataReq.hLayer1 = gl1->hLayer1;
+		break;
+	case GsmL1_PrimId_PhConnectInd:
+		break;
+	case GsmL1_PrimId_PhReadyToSendInd:
+		break;
+	case GsmL1_PrimId_PhDataInd:
+		break;
+	case GsmL1_PrimId_PhRaInd:
+		break;
+	default:
+		LOGP(DL1C, LOGL_ERROR, "unknown L1 primitive %u\n", id);
+		break;
+	}
+	return &prim->u;
+}
+
+GsmL1_Status_t prim_status(GsmL1_Prim_t *prim)
+{
+	/* for some reason the Status field is not always at the same position
+	 * in the GsmL1_Prim_t, so we have to have this ugly case statement here... */
+	switch (prim->id) {
+	case GsmL1_PrimId_MphInitCnf:
+		return prim->u.mphInitCnf.status;
+	case GsmL1_PrimId_MphCloseCnf:
+		return prim->u.mphCloseCnf.status;
+	case GsmL1_PrimId_MphConnectCnf:
+		return prim->u.mphConnectCnf.status;
+	case GsmL1_PrimId_MphDisconnectCnf:
+		return prim->u.mphDisconnectCnf.status;
+	case GsmL1_PrimId_MphActivateCnf:
+		return prim->u.mphActivateCnf.status;
+	case GsmL1_PrimId_MphDeactivateCnf:
+		return prim->u.mphDeactivateCnf.status;
+	case GsmL1_PrimId_MphConfigCnf:
+		return prim->u.mphConfigCnf.status;
+	case GsmL1_PrimId_MphMeasureCnf:
+		return prim->u.mphMeasureCnf.status;
+	default:
+		break;
+	}
+	return GsmL1_Status_Success;
+}
+
+#if 0
+static int compl_cb_send_oml_msg(struct msgb *l1_msg, void *data)
+{
+	struct msgb *resp_msg = data;
+	GsmL1_Prim_t *l1p = msgb_l1prim(l1_msg);
+
+	if (prim_status(l1p) != GsmL1_Status_Success) {
+		LOGP(DL1C, LOGL_ERROR, "Rx %s, status: %s\n",
+			get_value_string(femtobts_l1prim_names, l1p->id),
+			get_value_string(femtobts_l1status_names, cc->status));
+		return 0;
+	}
+
+	msgb_free(l1_msg);
+
+	return abis_nm_sendmsg(msg);
+}
+#endif
+
+int lchan_activate(struct gsm_lchan *lchan);
+
+static int opstart_compl_cb(struct msgb *l1_msg, void *data)
+{
+	struct gsm_abis_mo *mo = data;
+	GsmL1_Prim_t *l1p = msgb_l1prim(l1_msg);
+	GsmL1_Status_t status = prim_status(l1p);
+
+	if (status != GsmL1_Status_Success) {
+		LOGP(DL1C, LOGL_ERROR, "Rx %s, status: %s\n",
+			get_value_string(femtobts_l1prim_names, l1p->id),
+			get_value_string(femtobts_l1status_names, status));
+		return oml_mo_opstart_nack(mo, NM_NACK_CANT_PERFORM);
+	}
+
+	msgb_free(l1_msg);
+
+	/* Set to Operational State: Enabled */
+	oml_mo_state_chg(mo, NM_OPSTATE_ENABLED, NM_AVSTATE_OK);
+
+	/* ugly hack to auto-activate all SAPIs for the BCCH/CCCH on TS0 */
+	if (mo->obj_class == NM_OC_CHANNEL && mo->obj_inst.trx_nr == 0 &&
+	    mo->obj_inst.ts_nr == 0) {
+		DEBUGP(DL1C, "====> trying to activate lchans of BCCH\n");
+		lchan_activate(&mo->bts->c0->ts[0].lchan[0]);
+	}
+
+	/* Send OPSTART ack */
+	return oml_mo_opstart_ack(mo);
+}
+
+static int trx_init_compl_cb(struct msgb *l1_msg, void *data)
+{
+	struct femtol1_hdl *fl1h = data;
+	struct gsm_bts_trx *trx = fl1h->priv;
+
+	GsmL1_Prim_t *l1p = msgb_l1prim(l1_msg);
+	GsmL1_MphInitCnf_t *ic = &l1p->u.mphInitCnf;
+
+	/* store layer1 handle */
+	if (ic->status == GsmL1_Status_Success)
+		fl1h->hLayer1 = ic->hLayer1;
+
+	return opstart_compl_cb(l1_msg, &trx->mo);
+}
+
+/* initialize the layer1 */
+static int trx_init(struct gsm_bts_trx *trx)
+{
+	struct msgb *msg = l1p_msgb_alloc();
+	struct femtol1_hdl *fl1h = trx_femtol1_hdl(trx);
+	GsmL1_MphInitReq_t *mi_req;
+	GsmL1_DeviceParam_t *dev_par;
+
+	mi_req = prim_init(msgb_l1prim(msg), GsmL1_PrimId_MphInitReq, fl1h);
+	dev_par = &mi_req->deviceParam;
+	dev_par->devType = GsmL1_DevType_TxdRxu;
+	dev_par->freqBand = GsmL1_FreqBand_1800;
+	dev_par->u16Arfcn = trx->arfcn;
+	dev_par->u16BcchArfcn = trx->bts->c0->arfcn;
+	dev_par->u8NbTsc = trx->bts->bsic & 7;
+	DEBUGP(DL1C, "Setting TSC=%d\n", dev_par->u8NbTsc);
+	dev_par->fRxPowerLevel = -75.f;
+	dev_par->fTxPowerLevel = trx->nominal_power - trx->max_power_red;
+	
+	/* send MPH-INIT-REQ, wait for MPH-INIT-CNF */
+	return l1if_req_compl(fl1h, msg, 0, trx_init_compl_cb, fl1h);
+}
+
+static int ts_connect(struct gsm_bts_trx_ts *ts)
+{
+	struct msgb *msg = l1p_msgb_alloc();
+	struct femtol1_hdl *fl1h = trx_femtol1_hdl(ts->trx);
+	GsmL1_MphConnectReq_t *cr;
+
+	cr = prim_init(msgb_l1prim(msg), GsmL1_PrimId_MphConnectReq, fl1h);
+	cr->u8Tn = ts->nr;
+	cr->logChComb = pchan_to_logChComb[ts->pchan];
+	
+	return l1if_req_compl(fl1h, msg, 0, opstart_compl_cb, &ts->mo);
+}
+
+GsmL1_SubCh_t lchan_to_GsmL1_SubCh_t(const struct gsm_lchan *lchan)
+{
+	switch (lchan->ts->pchan) {
+	case GSM_PCHAN_CCCH_SDCCH4:
+	case GSM_PCHAN_TCH_H:
+	case GSM_PCHAN_SDCCH8_SACCH8C:
+		return lchan->nr;
+	case GSM_PCHAN_NONE:
+	case GSM_PCHAN_CCCH:
+	case GSM_PCHAN_TCH_F:
+	case GSM_PCHAN_PDCH:
+	case GSM_PCHAN_UNKNOWN:
+	default:
+		return GsmL1_SubCh_NA;
+	}
+
+	return GsmL1_SubCh_NA;
+}
+
+struct sapi_dir {
+	GsmL1_Sapi_t sapi;
+	GsmL1_Dir_t dir;
+};
+
+static const struct sapi_dir ccch_sapis[] = {
+	{ GsmL1_Sapi_Fcch,	GsmL1_Dir_TxDownlink },
+	{ GsmL1_Sapi_Sch, 	GsmL1_Dir_TxDownlink },
+	{ GsmL1_Sapi_Bcch,	GsmL1_Dir_TxDownlink },
+	{ GsmL1_Sapi_Agch,	GsmL1_Dir_TxDownlink },
+	{ GsmL1_Sapi_Pch,	GsmL1_Dir_TxDownlink },
+	{ GsmL1_Sapi_Rach,	GsmL1_Dir_RxUplink },
+};
+
+#define DIR_BOTH	(GsmL1_Dir_TxDownlink|GsmL1_Dir_RxUplink)
+
+static const struct sapi_dir tchf_sapis[] = {
+	{ GsmL1_Sapi_TchF,	DIR_BOTH },
+	{ GsmL1_Sapi_FacchF,	DIR_BOTH },
+	{ GsmL1_Sapi_Sacch,	DIR_BOTH },
+};
+
+static const struct sapi_dir tchh_sapis[] = {
+	{ GsmL1_Sapi_TchH,	DIR_BOTH },
+	{ GsmL1_Sapi_FacchH, 	DIR_BOTH },
+	{ GsmL1_Sapi_Sacch,	DIR_BOTH },
+};
+
+static const struct sapi_dir sdcch_sapis[] = {
+	{ GsmL1_Sapi_Sdcch, 	DIR_BOTH },
+	{ GsmL1_Sapi_Sacch,	DIR_BOTH },
+};
+
+struct lchan_sapis {
+	const struct sapi_dir *sapis;
+	unsigned int num_sapis;
+};
+
+static const struct lchan_sapis sapis_for_lchan[_GSM_LCHAN_MAX] = {
+	[GSM_LCHAN_SDCCH] = {
+		.sapis = sdcch_sapis,
+		.num_sapis = ARRAY_SIZE(sdcch_sapis),
+	},
+	[GSM_LCHAN_TCH_F] = {
+		.sapis = tchf_sapis,
+		.num_sapis = ARRAY_SIZE(tchf_sapis),
+	},
+	[GSM_LCHAN_TCH_H] = {
+		.sapis = tchh_sapis,
+		.num_sapis = ARRAY_SIZE(tchh_sapis),
+	},
+	[GSM_LCHAN_CCCH] = {
+		.sapis = ccch_sapis,
+		.num_sapis = ARRAY_SIZE(ccch_sapis),
+	},
+};
+
+static int lchan_act_compl_cb(struct msgb *l1_msg, void *data)
+{
+	struct gsm_lchan *lchan = data;
+	GsmL1_Prim_t *l1p = msgb_l1prim(l1_msg);
+	GsmL1_MphActivateCnf_t *ic = &l1p->u.mphActivateCnf;
+
+	LOGP(DL1C, LOGL_NOTICE, "%s MPH-ACTIVATE.conf\n", gsm_lchan_name(lchan));
+
+	if (ic->status == GsmL1_Status_Success) {
+		DEBUGP(DL1C, "Successful activation of L1 SAPI %s on TS %u\n",
+			get_value_string(femtobts_l1sapi_names, ic->sapi), ic->u8Tn);
+		lchan->state = LCHAN_S_ACTIVE;
+	} else {
+		LOGP(DL1C, LOGL_ERROR, "Error activating L1 SAPI %s on TS %u: %s\n",
+			get_value_string(femtobts_l1sapi_names, ic->sapi), ic->u8Tn,
+			get_value_string(femtobts_l1status_names, ic->status));
+		lchan->state = LCHAN_S_NONE;
+	}
+
+	switch (ic->sapi) {
+	case GsmL1_Sapi_Sdcch:
+	case GsmL1_Sapi_TchF:
+		/* FIXME: Send RSL CHAN ACT */
+		break;
+	default:
+		break;
+	}
+
+	msgb_free(l1_msg);
+
+	return 0;
+}
+
+uint32_t l1if_lchan_to_hLayer2(struct gsm_lchan *lchan)
+{
+	return (lchan->nr << 8) | (lchan->ts->nr << 16) | (lchan->ts->trx->nr << 24);
+}
+
+/* obtain a ptr to the lapdm_channel for a given hLayer2 */
+struct gsm_lchan *
+l1if_hLayer2_to_lchan(struct gsm_bts_trx *trx, uint32_t hLayer2)
+{
+	uint8_t ts_nr = (hLayer2 >> 16) & 0xff;
+	uint8_t lchan_nr = (hLayer2 >> 8)& 0xff;
+	struct gsm_bts_trx_ts *ts;
+
+	/* FIXME: if we actually run on the BTS, the 32bit field is large
+	 * enough to simply put a pointer inside. */
+	if (ts_nr >= ARRAY_SIZE(trx->ts))
+		return NULL;
+
+	ts = &trx->ts[ts_nr];
+
+	if (lchan_nr >= ARRAY_SIZE(ts->lchan))
+		return NULL;
+
+	return &ts->lchan[lchan_nr];
+}
+
+
+
+int lchan_activate(struct gsm_lchan *lchan)
+{
+	struct femtol1_hdl *fl1h = trx_femtol1_hdl(lchan->ts->trx);
+	const struct lchan_sapis *s4l = &sapis_for_lchan[lchan->type];
+	unsigned int i;
+
+	for (i = 0; i < s4l->num_sapis; i++) {
+		struct msgb *msg = l1p_msgb_alloc();
+		GsmL1_MphActivateReq_t *act_req;
+
+		act_req = prim_init(msgb_l1prim(msg), GsmL1_PrimId_MphActivateReq, fl1h);
+		act_req->u8Tn = lchan->ts->nr;
+		act_req->subCh = lchan_to_GsmL1_SubCh_t(lchan);
+		act_req->dir = s4l->sapis[i].dir;
+		act_req->sapi = s4l->sapis[i].sapi;
+		act_req->hLayer2 = l1if_lchan_to_hLayer2(lchan);
+
+		switch (act_req->sapi) {
+		case GsmL1_Sapi_Rach:
+			act_req->logChPrm.rach.u8Bsic = lchan->ts->trx->bts->bsic;
+			break;
+		case GsmL1_Sapi_Agch:
+#warning Set BS_AG_BLKS_RES
+			act_req->logChPrm.agch.u8NbrOfAgch = 1;
+			break;
+		case GsmL1_Sapi_Sacch:
+			/* Only if we use manual MS power control */
+			//act_req->logChPrm.sacch.u8MsPowerLevel = FIXME;
+			break;
+		case GsmL1_Sapi_TchH:
+		case GsmL1_Sapi_TchF:
+#warning Set AMR parameters for TCH
+			break;
+		default:
+			break;
+		}
+
+		LOGP(DL1C, LOGL_NOTICE, "%s MPH-ACTIVATE.req (hL2=0x%08x)\n",
+			gsm_lchan_name(lchan), act_req->hLayer2);
+
+		/* send the primitive for all GsmL1_Sapi_* that match the LCHAN */
+		l1if_req_compl(fl1h, msg, 0, lchan_act_compl_cb, lchan);
+
+	}
+	lchan->state = LCHAN_S_ACT_REQ;
+
+	lchan_init_lapdm(lchan);
+
+	return 0;
+}
+
+static int lchan_deact_compl_cb(struct msgb *l1_msg, void *data)
+{
+	struct gsm_lchan *lchan = data;
+	GsmL1_Prim_t *l1p = msgb_l1prim(l1_msg);
+	GsmL1_MphDeactivateCnf_t *ic = &l1p->u.mphDeactivateCnf;
+
+	LOGP(DL1C, LOGL_NOTICE, "%s MPH-DEACTIVATE.conf\n", gsm_lchan_name(lchan));
+
+	if (ic->status == GsmL1_Status_Success) {
+		DEBUGP(DL1C, "Successful deactivation of L1 SAPI %s on TS %u\n",
+			get_value_string(femtobts_l1sapi_names, ic->sapi), ic->u8Tn);
+		lchan->state = LCHAN_S_ACTIVE;
+	} else {
+		LOGP(DL1C, LOGL_ERROR, "Error deactivating L1 SAPI %s on TS %u: %s\n",
+			get_value_string(femtobts_l1sapi_names, ic->sapi), ic->u8Tn,
+			get_value_string(femtobts_l1status_names, ic->status));
+		lchan->state = LCHAN_S_NONE;
+	}
+
+	switch (ic->sapi) {
+	case GsmL1_Sapi_Sdcch:
+	case GsmL1_Sapi_TchF:
+		/* FIXME: Send RSL CHAN REL ACK */
+		break;
+	default:
+		break;
+	}
+
+	msgb_free(l1_msg);
+
+	return 0;
+}
+
+int lchan_deactivate(struct gsm_lchan *lchan)
+{
+	struct femtol1_hdl *fl1h = trx_femtol1_hdl(lchan->ts->trx);
+	const struct lchan_sapis *s4l = &sapis_for_lchan[lchan->type];
+	unsigned int i;
+
+	for (i = 0; i < s4l->num_sapis; i++) {
+		struct msgb *msg = l1p_msgb_alloc();
+		GsmL1_MphDeactivateReq_t *deact_req;
+
+		deact_req = prim_init(msgb_l1prim(msg), GsmL1_PrimId_MphDeactivateReq, fl1h);
+		deact_req->u8Tn = lchan->ts->nr;
+		deact_req->subCh = lchan_to_GsmL1_SubCh_t(lchan);
+		deact_req->dir = s4l->sapis[i].dir;
+		deact_req->sapi = s4l->sapis[i].sapi;
+
+		LOGP(DL1C, LOGL_NOTICE, "%s MPH-DEACTIVATE.req\n",
+			gsm_lchan_name(lchan));
+
+		/* send the primitive for all GsmL1_Sapi_* that match the LCHAN */
+		l1if_req_compl(fl1h, msg, 0, lchan_deact_compl_cb, lchan);
+
+	}
+	lchan->state = LCHAN_S_ACT_REQ;
+
+	return 0;
+}
+
+
+struct gsm_time *bts_model_get_time(struct gsm_bts *bts)
+{
+	struct femtol1_hdl *fl1h = trx_femtol1_hdl(bts->c0);
+
+	return &fl1h->gsm_time;
+}
+
+/* callback from OML */
+int bts_model_check_oml(struct gsm_bts *bts, uint8_t msg_type,
+			struct tlv_parsed *old_attr, struct tlv_parsed *new_attr,
+			void *obj)
+{
+	/* FIXME: check if the attributes are valid */
+	return 0;
+}
+
+/* callback from OML */
+int bts_model_apply_oml(struct gsm_bts *bts, struct msgb *msg,
+			struct tlv_parsed *new_attr, void *obj)
+{
+	/* FIXME: we actaully need to send a ACK or NACK for the OML message */
+	return oml_fom_ack_nack(msg, 0);
+}
+
+/* callback from OML */
+int bts_model_opstart(struct gsm_bts *bts, struct gsm_abis_mo *mo,
+		      void *obj)
+{
+	int rc;
+
+	switch (mo->obj_class) {
+	case NM_OC_RADIO_CARRIER:
+		rc = trx_init(obj);
+		break;
+	case NM_OC_CHANNEL:
+		rc = ts_connect(obj);
+		break;
+	case NM_OC_BTS:
+	case NM_OC_SITE_MANAGER:
+	case NM_OC_BASEB_TRANSC:
+		mo->nm_state.operational = NM_OPSTATE_ENABLED;
+		rc = oml_mo_opstart_ack(mo);
+	default:
+		rc = oml_mo_opstart_nack(mo, NM_NACK_OBJCLASS_NOTSUPP);
+	}
+	return rc;
+}
+
+int bts_model_chg_adm_state(struct gsm_bts *bts, struct gsm_abis_mo *mo,
+			    void *obj, uint8_t adm_state)
+{
+	/* blindly accept all state changes */
+	mo->nm_state.administrative = adm_state;
+	return oml_mo_fom_ack_nack(mo, NM_MT_CHG_ADM_STATE, 0);
+}